# sap-dependency-security

Guards SAP projects against supply chain risks and enforces strict executable rules for MCP servers. Useful when upgrading libraries in SAP CAP or BTP.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 558 installs · ★ 475
- Author: secondsky
- License: GPL-3.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/secondsky/sap-skills/tree/HEAD/plugins/sap-dependency-security/skills/sap-dependency-security/SKILL.md
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/skills/sap-dependency-security

## What it does

This skill configures package manager rules across npm, Bun, pnpm, Yarn, or Deno. It restricts dangerous lifecycle scripts and sets publication cooldown periods. You can run an interactive setup questionnaire or load recommended defaults with a seven-day release delay.

The dedicated SAP Development Mode enforces strict boundaries. It raises package cooldown to 14 days and requires exact version pinning for all MCP tooling inside `.mcp.json`. Floating `@latest` tags are rejected. Local forks, such as SAC MCP servers, require a hard-pinned commit SHA.

Skipping exact pins breaks drift validation when executing `npm run validate:mcp-security`. The skill also builds automation profiles for Dependabot or Renovate with defined merge schedules.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add secondsky/sap-skills --skill sap-dependency-security -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/sap-dependency-security/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/sap-dependency-security/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add secondsky/sap-skills --skill sap-dependency-security -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/sap-dependency-security/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add secondsky/sap-skills --skill sap-dependency-security -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/sap-dependency-security/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install secondsky/sap-skills sap-dependency-security
```

2. **Manually: put the files in place**
- File: `.github/skills/sap-dependency-security/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add secondsky/sap-skills --skill sap-dependency-security -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/secondsky/sap-skills --path plugins/sap-dependency-security/skills/sap-dependency-security
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/sap-dependency-security/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add secondsky/sap-skills --skill sap-dependency-security -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/secondsky/sap-skills/tree/HEAD/plugins/sap-dependency-security/skills/sap-dependency-security/SKILL.md

## When to use it
- block post-install lifecycle scripts across package managers
- enforce package release cooldowns against early zero-days
- lock down MCP executable versions inside `.mcp.json`
- prepare Dependabot or Renovate configs with scheduled review rules

## Example prompts
- Review .mcp.json and replace any floating latest tags with exact versions
- Configure pnpm security policies with a 14-day package cooldown period
- Generate a secure dependabot.yml configuration for an SAP CAP project

## Similar
- [dependency-upgrade](https://affpapa.org/en/nevibecode/skills/secondsky-dependency-upgrade.md) — skill · 404 installs
- [npm-security-best-practices](https://affpapa.org/en/nevibecode/skills/npm-security-best-practices.md) — skill · 919 installs
- [check-npm](https://affpapa.org/en/nevibecode/skills/check-npm.md) — skill · 2800 installs
- [dependency-check](https://affpapa.org/en/nevibecode/skills/dependency-check.md) — skill · 748 installs
- [dependency-audit](https://affpapa.org/en/nevibecode/skills/bobmatnyc-dependency-audit.md) — skill · 422 installs
- [dependency-scan](https://affpapa.org/en/nevibecode/skills/dependency-scan.md) — skill · 355 installs

From the same set: [secondsky/sap-skills](https://affpapa.org/en/nevibecode/by/secondsky/sap-skills.md) — 24 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md